hasura / hasura/graphql-engine
Queries do not fallback to unauthorized user role if custom defined auth cookie header is not present
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: v2.0.8.cloud-3
### Environment
Cloud
### What is the expected behaviour?
If a cookie header is identified in HASURA_GRAPHQL_JWT_SECRET, but not provided in a request, it should assume any anonymous defined role.
### Keywords
header, cookie, jwt
### What is the current behaviour?
Server error that the cookie was not found.
### How to reproduce the issue?
1. Define `HASURA_GRAPHQL_JWT_SECRET` with an optional header type of cookie and a custom name.
2. Define an anonymous role
3. Make a query without. the specified cookie.
### Screenshots or Screencast
### Please provide any traces or logs that could help here.
### Any possible solutions?
### Can you identify the location in the source code where the problem exists?
### If the bug is confirmed, would you be willing to submit a PR?
Contributor guide
Research direction
Start by reproducing the request described with a custom cookie header in HASURA_GRAPHQL_JWT_SECRET, an anonymous role, and no cookie. Trace the JWT authentication handling to find why a missing cookie is treated as an error; done means the request falls back to the configured anonymous role without that error, with regression coverage for the scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- api, authentication, authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100